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We propose a new quantum secret sharing scheme using a single non-entangled qubit. In the 
scheme, by transmitting a qubit to the next party sequentially, a sender can securely transmit a 
secret message to A'' receivers who could only decode the message cooperatively after randomly 
shuffling the polarization of the qubit. We explain this quantum secret sharing scheme into the one 
between a sender and two receivers, and generalize the scheme between a sender and A'' receivers. 
Since our scheme is capable of using a faint coherent pulse as a qubit, it is experimentally feasible 
within current technology. 

PACS numbers: 03.67.Dd,03.67.Hk 



I. INTRODUCTION 

A cryptography based on quantum mechanics has received much attention since the seminal work on quantum key 
distribution (QKD) by Bennett and Brassard (BB84) ^ and Ekert (E91) In this scheme, information can be 
securely transmitted to a privileged person in novel ways [3|,3- In distinction to this type of one-to-one communication, 
recently, another quantum cryptography scheme, named quantum secret sharing (QSS), was proposed by Hillery, 
Buzek, and Berthiaume (HBB99) [5i]. Through this scheme a common key or a secret message can be securely 
distributed to many parties simultaneously, who are not entirely trusted. Then, while no one alone can recover the 
message, the receivers can cooperatively recover the message by combining the whole distributed information of the 
sender. Since this cryptography scheme of QSS can be used effectively when a sender wants to transmit a message 
to many untrusted parties simultaneously, a lot of works have succeeded theoretically [1, 0, S and experimentally 
as one of the most important applications of quantum cryptography. 

Most of the proposed QSS protocols use an entangled state b, 6, 8, iOjIUllllI- Yet, the use of the entangled state 
is not easy for multiparty secret sharing, since the efficiency of preparing many-partite entangled state is not high 
enough for real application [Tsl, (T^. In addition, the communication efficiency of the proposed QSS protocols has 
reached in maxmum 50% in principle p^ . 

Meanwhile, two QSS protocols without entanglement were proposed, which were modifications of BB84 j^. One 
protocol is that a sender creates a two-qubit product state in the base Z = {|0), |1)} or X = |— )} and sends 

each qubit to the receivers, respectively. Then each receiver measures his own received qubit and decodes the key 
bit by coworking with the other receivers. In this protocol, the theoretical communication efficiency has doubled in 
comparison with the scheme using an entangled state. Another protocol is that a sender sends a string of qubits to 
receivers, in which key bits are encoded. Each receiver shuffles the polarization of the string of qubits with his own 
parameters and sends the string to the next receiver sequentially. Then, the last receiver measures the polarization 
of the string and decodes the information from the sender by combining the receivers' shuffling parameters. More 
recently, a single qubit QSS was proposed experimentally [l^. However, the problem with these protocols is that 
they are insecure against photon number splitting (PNS) attack except the case of the use of a single photon as 
a qubit. Moreover, even though the protocols may use a single photon, it is not easy to make a reliable single-photon 
source with current technology and photons may be easily lost due to the imperfect channel efflciency. To overcome 
this vulnerability of QSS protocols without entanglement, in this paper, we propose a new secure QSS protocol, which 
is without entanglement, and can use a single not-so weak coherent laser pulse as a qubit. 

II. PROTOCOL 



As is shown in the schematic diagram in Fig. 1, our protocol uses a randomly polarized qubit. Here the sender Alice 
sends a single randomly polarized not-so- weak pulse to the receiver Rec-1. On receiving the qubit, Rec-1 prepares two 
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FIG. 1: Schematic diagram of QSS protocol with a single qubit. PS is the photon source, PR the polarization rotator, BS the 
beam splitter and PBS the polarizing beam splitter. 



rotational angles, an arbitrary random angle (pi to hide the qubit polarization and the other one si € {0, 7r/2, ±7r/4} 
to shuffle the qubit state, and rotates the polarization of the received qubit. Then he sends the qubit to Rec-2. Rec-2 
puts the received qubit in the same process, but with different random angles, (f>2 to hide the qubit polarization and 
S2 £ {0, 7r/2, ±7r/4} to shuffle the qubit state, and returns the qubit to Alice. Alice compensates her random angle, 
codes a key bit, and randomly shuffles the polarization basis. Then she sends the qubit to Rec-2. Rec-2 compensates 
his arbitrary random angle (j)2 and sends the qubit to Rec-1. Rec-1 also compensates his random angle cpi and measures 
the photon state. When Alice publicly announces the basis of the qubit, Rec-1 and Rec-2 cooperatively decode and 
share the key bit. For integrity, after error correction and privacy amplification, Alice, Rec-1, and Rec-2 check the 
shared key bit with a hash function. In this QSS protocol each receiver generates his own hidden information so 
that the information given by the sender can be decoded only when the two receivers' and the sender's information 
is joined. 

Protocol- The procedure of the proposed QSS is as follows: 

(p.l) The sender, Alice, prepares a linearly polarized qubit whose initial state is |0) and prepares an arbitrary random 
angle 6. Then Alice rotates the polarization of the qubit by the prepared angle 9, to bring the state j^'o) = 
Uy{6)\0) = \9), where Uy{0) = cosfll — iainda-y rotating the polarization angle along the y-axis. ay is the 



Pauli-y operator. Alice sends the qubit of jV'o) to Rec-1. 



(p. 2) Rec-1 chooses another random angles 
Then the qubit state is = \0 + (f>i 



)i and si, and rotates the polarizations of the received qubit by 0i 
f si). Rec-1 sends the qubit to Rec-2. 



Si. 



(p. 3) On receiving the qubit, Rec-2 also chooses other random angles 4>2 and S2, and rotates the polarization of the 



received qubit by 02 +S2- Then the qubit state becomes \'ip2) = + 
to Alice. 



Si]). Then Rec-2 sends the qubit 



(p. 4) Alice rotates the polarization of the received qubit by ki g {0,7r/2} or k2 G {±7r/4} to encode the key bit, 
and compensates her random angle by applying —9. Here, if Alice wants to encode '0' ('1') to the qubit, she 
rotates the polarization of qubit by {0,7r/4} ({7r/2, — 7r/4}). The state becomes l-^s) = \kj +J2i=i['t'i + 
where j G {1, 2}. Then Alice transmits the encoded qubit to Rec-2. 

(p. 5) After receiving the qubit, Rec-2 compensates his random angle by rotating the polarization of the received qubit 
by ~(f)2, and sends the qubit to Rec-1. 

(p.6) Rec-1 compensates his random angle by rotating the polarization by —(f>i, divides the received qubit into two 
qubits, and measures the polarization of each qubit, one on the rectilinear basis, {|0), |7r/2)}, and the other on 
the diagonal basis, {| -I- 7r/4), | — 7r/4)}. The reason of the division here is because Rec-1 does not know the 
polarization basis on this stage. The basis of the qubit is determined by kj + J2i=i ^i- We can find the basis 
from Table 1. So after measurement, Rec-1 stores the results of each measurement until he knows the whole 
values of kj + = Therefore, Rec-l's ultimate decision angle is I — si and Rec-2's is S2- 
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TABLE I: Polarization angles from Alice's encoding depending on Rec-l's and Rec-2's ultimate decision angles. Rec-1 and 
Rec-2 have a key from mutual relations among their own values. 

(p. 7) Here, to make M bits of the key string, the three authorized persons repeat the above protocol A^(> M) times. 
Rec-1 can lose the key bit for one part of division of some qubits, because of the division of the qubit. In other 
word, one part of the division may happen to have a vacuum state. If sifted key is shorter than required, the 
parties need only follow the same procedure from the start until the sifted key string is of satisfactory length 
(M bits). Rec-1 discards N — M qubits which make vacuum states. As a result, Rec-1 gets M bits of the key 
string. 

(p. 8) Alice publicly announces her M basis shuffling factors j. However, Rec-1 and Rec-2 still do not know in which 
basis to look yet, because they know nothing about the action of the other. Therefore, the receivers get together 
and compare their polarization angles to recover the key angle string from Alice. Then they can find the basis 
and key angle as shown in Table 1. 

(p. 9) Alice has M bits of fc, while each of Rec-1 and Rec-2 has M bits of their decision angles, l — si and S2, respectively. 
Rec-1 and Rec-2 cooperatively recover the M bits of the key value k with their own decision angles I — si and 
S2- In this process Rec-1 and Rec-2 individually exchange their angles I ~ si and S2- Then the receivers have 
the key angles of fci for Rec-1 and k2 for Rec-2. 

(p. 10) (Error correction and privacy amplification) After recovering the key angles, they proceed error correction and 
privacy amplification using same method with BB84 protocol. Alice and receivers can convert the polarization 
of key bits into raw key bits regarding a or -f7r/4 as denoting a '0' and a 7r/2 or — 7r/4 as a '1'. 

(p. 11) (Check of integrity) Rec-1 and Rec-2 publicly announce the hash values of the recovered key bit hi = H{ki) 
and /i2 = H{k2) to Alice, respectively, where H is the hash function. Then Alice announces her hash value of 
ho = H{k) to Rec-1 and Rec-2, individually. They compare the received hash value with their own. When the 
hash values are the same, they share the key bits, otherwise all parties abolish the key bits and they repeat the 
protocol again. 

Through this protocol, three parties can share key string through quantum channels. Note that, by slightly modi- 
fying the procedure of from (p. 6) to (p. 8) in the protocol, we can increase the communication efficiency. 

III. SECURITY 

Honesty — As for secret sharing, if one of the receivers is dishonest, the dishonest one could get the true information, 
while the others might have wrong one. However, in this protocol, let us assume that Rec-1 knows the true key bits 
from Rec-2's announcement of his decision factor S2- If Rec-1 gives wrong information of I or si to Rec-2, Rec-2 has 
wrong information so that hi Moreover, when Alice compares her hash value with the received ones from Rec-1 

and Rec-2, the hash values become hi — ho while /i2 7^ ^o- Hence Alice knows who is dishonest. 

Security — In QSS, there are various attack strategies depending on the protocol [![. Since the PNS and the 
impersonation attacks are considered to be the most efficient ones from an eavesdropper's prospective, we examine 
the security of our protocol against those attacks. For ease of discussion, we consider that Eve, the eavesdropper, is 
so superior that her action is limited only by the laws of physics. We examine the security when a key is encoded into 
a cohereirt-state pulse, \a) = |y^e'^), with the mean number of photons /it. And the transmission on a line of length 
I [km] is r = 10-^/'^°, where d ^ al with the losses a [dB/km] on the fine [H. 

PNS attack — The conventional strategy of the PNS attack for weak coherent laser pulses is that Eve splits off 
a qubit from each pulse and keeps it in the quantum storage. When the basis reconciliation is made between Alice 
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FIG. 2: Impersonation attack; Eve impersonates Alice and two receivers, Rec-1 and Rec-2. 



and all the receivers via a classical channel, Eve gets the secret information by measuring the state of the stored 
qubit during the bases are announced. In this scheme, Eve can measure the number of photons with quantum non- 
demolition method [l^. When more than two photons are transmitted, she splits off one photon and stores it. After 
the reconciliation procedure between Alice and the receivers Eve measures the photon polarization. In our protocol, 
however, all qubits in any step have a completely random polarization. Even if Eve splits off some photons from a 
qubit in the channel between Alice and the receivers, she should determine two continuous angles d and 0^. Moreover, 
since Eve does not know the polarization basis, she should just estimate the polarization angle with some probability 
of error. If, for simplicity's sake, we assume that each channel has a same distance. Eve's mean number of photons 
of each channel from PNS is /iT'^^^(l — T), where c S {1,3,4} means c-th channel of PNS. Then she might try to 
estimate the polarization with the photons. The optimum estimation of the random polarizations in this case can 
be obtained from the fidelity which is calculated to consider the amount of information. Depending on the initial 
amplitude and the transmission rate, we find the maximum bound for Eve's information by fidelity as well presented 
in [201 • In this paper, for the realistic transmission T = 0.5 and its amplitude jy^e**! = 2.83 give fidelity Fe = 0.83. 

Another possible PNS attack is that Eve counts the number of photons at the output of Alice's box. If she finds 
more than one, she keeps one photon and forwards the others. Eve waits until photons come back from Rec-2. Eve 
attaches her unpertubed photon to the others, and sends these photons to Alice. After the process (p. 4), when Alice 
sends the encoded qubit, Eve intercepts the qubit and pick up her photon. At this time. Since Eve knows where she 
attached the photon, she can easily picks up it. Then the polarization of Eve's photon is exactly the one chosen by 
Alice to code her key bit, because the photon has not been perturbed by the receivers. Eve keeps the photon and 
sends the others to the receivers. Here, one of the possible ways to pick up the same photon is to send her photon in 
just before or just after the others with a very fast switch when photons are transmitted from Rec-2 to Alice. When 
the shuffling factors are announced Eve recovers the key bits. This type of attack can be prevented easily, when Alice 
uses a beam splitter. Alice divides her photons into two using a beam splitter in the process (p. 4) and sends one part 
of the split photons. Since Eve does not know whether her photon is lost or not by the beam splitter. Eve gets wrong 
key bits depending. This counter-attack method does not degrade the communication efficiency, because our protocol 
uses a not-so-weak coherent pulse. 

The second way is that Eve slightly modifies the wavelength of her photon through a non-linear process which does 
not change the polarization. In this case Eve also loses her photon because of the beam splitter. If the key length is 
long. Eve can not attack the key bit. For example, when the key length is 256 bits and the beam splitter is a 50:50 
one. Eve should use a brute text attack for the unknown 128 bit. This is in no ways different from the brute text 
attack to a key of 128 bit length, which is a usual key length in modern cryptosystem. Another counter-attack method 
is also well explain in Ref. 21]. According to this method, Alice and the receivers can filter out unwanted frequencies 
by using an optical device, which is the combination of an optical grating and a very small frequency bandwidth filter 
like a high resolution Fabry-Perot interferometer. In any case, the most simple and efficient way to prevent an attack 
is to use a beam splitter. Hence, the conventional PNS attacks are not valid in our protocol as described above even 
though we can use a not-so-weak coherent pulse to make quantum secret sharing. 

Impersonation attack — Even if we use a not-so-weak coherent pulse instead of a single-photon to make key bits. 
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FIG. 3: Rec-l's error rate Perror depending on Eve's optimal probability for discriminating between the four states under the 
number of n photons fiT; when Rec-1 knows mean photon number, he gets error rate to check the existence of Eve. 



our protocol is secure against the impersonation attack [2^, in which Eve impersonates Alice to Rec-1 and Rec-2 and 
vice versa. The strategy of the attack is shown in Fig. 2. Eve intercepts the transmitting qubit from Alice to Rec-1, 
and sends a different pulse which is prepared by herself. When Eve's qubit is returned from Rec-2, Eve intercepts the 
qubit and stores it. Eve rotates Alice's qubit and sends it to Alice. When Alice sends her qubit to Rec-2 after encoding 
a key, Eve intercepts Alice's qubit and measures it after compensating her random angle. After the measurement. Eve 
encodes the key angle, which she has measured, to the stored qubit and sends it to Rec-2. On this condition, as far as 
Alice does not shuffle the polarization basis, Eve can measure the angle without any difficulty. Because of Alice's basis 
shuffling, however. Eve can not encode the key angle perfectly. Let us calculate the error rate of Rec-l's measurement. 
As far as polarization is concerned. Eve has an exact copy of Alice's key. Therefore, Eve can obtain full information 
using strategies based on unambiguous state discrimination. Unambiguous discrimination among four states of a 
two-dimensional Hilbert space is only possible when at least three copies of the state are available. And the optimal 
probability for discriminating between the four states with n > 3 copies is found to be Pok{n) = 1 — (l/2)[^"~^^/^l, 
where [•] is the rounding to the closest lower integer [l^. The probability of there being n-photons in the coherent 
state with mean photon number /uT, which is reduced from /i, is pdn^^iT) = e~ ^'^ [jiT)^ / n\ . Then the maximal 
probability that Eve can discriminate the state without error is 



Pe = y^^Pok{n)pc{n,nT) 



n>3 



n>3 



Therefore, the error rate of Rec-l's side is 



Perror ~ 2^"*^ ~ ^'^^ 

since Eve's wrong encoding makes 1/2 error rate on Rec-l's side. The error rate depending on the mean photon 
number is plotted in Fig. 3. If the error rate from his measurement is similar to Perror , he can ascertain whether Eve 
exists or not. The figure shows that for T — 0.5 and /i ~ 6 the error rate is Perror — 0.3. In other words, when Alice 
sends a coherent state pulse with fj, — 6, the criterion to check eavesdropper is Perror — 0.3. 
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IV. GENERAL PROTOCOL 



In QSS, a sender usually shares a message with more than two receivers simultaneously. In our protocol, since 
we can use a single not-so-wcak coherent pulse, it is easy to generalize the QSS protocol for the case of {N + 1) 
multi-parties (iV > 2); one is a sender Alice and the others receivers. 

General protocol. — The general protocol among {N +1) parties is as follows: 

(F.O) Alice prepares a randomly polarized qubit I'^o) = |^) and sends it to Rec-1. 

(F.l) Rec-1 chooses his random angle 0i and rotates the polarizations of the received qubit by (pi + si, where 
si e {0, ±7r/4, 7r/2}. Rec-1 sends the qubit to Rec-2. 

(F.n) In this way, Rcc-n (n S {2, ...N — 1}) receives the qubit and repeats the same polarization procedure as his 
precedent. Then he sends it to Rec-(n + 1). 

(F.N) The state of the last receiver Kec-N becomes Ii/jn) = |^ + "^tLiW + ^d)- Then, Rec-N sends it to Alice. 

(F.N+l) Aftc;r receiving the qubit, Alice compensates her private angle with —9 and encodes her key angle, k. Then the 

state becomes \k + X^il^il"^* + Alice sends it back to N*'^ party. 

(B.N) Rec-A'^ receives the qubit from Alice and rotates the polarization angle with —4>n- The state becomes |A; -|- 
+ Then he transmits the qubit to Rec-(A^ — 1). 

(B.n) In this way, Rec-n receives the qubit from Rec-(n + 1). After rotating the polarization with Rec-n' angle. Then 
the state becomes \k + J2'i=i['P^] + J2i=il^i])- 

(B.l) Then, Rec-l's qubit state after compensating his random angle becomes|A; + J2^=i[^i])- Rec-l measures the 
polarization in the same way with (p. 6). 

(B.O) Since each party has his own decision angles Sj, they recover the key bits cooperatively. Then they can share 
the key from Alice. By repeating this procedure similar to the protocol between three parties, all receivers get 

the M bits of key string. 

Similar to the N = 2 case, Alice and all the receivers check the shared key bit with hash functions for the 
integrity. After receiving the key bits, all receivers publicly announce their hash values of the recovered key to Alice 
independently. Alice announces her hash value to all receivers, simultaneously. Then they compare the received hash 
value with their own H{k) = H{kn) where k is Alice's key bit and kn is the n*'' receiver's key bit. When all hash 
values are the same, they share the key bit, otherwise the key values are abolished and they repeat the protocol again. 



V. DISCUSSION AND SUMMARY 



Our QSS protocol has several advantages in comparison with the other QSS schemes: 

(1) Even though our protocol uses not-so-weak coherent pulses, the random polarization and the basis shuffling 
can effectively block up the PNS and the impersonation attacks, while the other QSS protocols without entanglement 
are vulnerable when they use not-so-weak coherent pulses. So our QSS protocol is easier to realize experimentally 
with modern technology than the other QSS protocols. We have modified the BB84 protocol to achieve stronger QSS 
protocol. Similarly, we can also make the QKD protocol stronger than BB84 for the above reasons. 

(2) In the step of (p. 6), Rec-1 splits the received qubit into two parts to measure the polarization with two different 
bases. To split the qubit, Rec-1 should get coherent-state pulse with mean photon number at least 2. As shown in 
Fig. 3, we can use multi-photon pulse and control the mean photon number by referring the relation between Pgrror 
and mean photon number. Therefore, comparing with the other QSS protocols without entanglement, we do not need 
to employ quantum memory to store the qubit even if we use non-orthogonal bases. 

(3) In this protocol, if one of the receivers, Rec-i, is dishonest and sends wrong decision factor to the other receivers, 
each of the honest receivers generates a different hash value. Alice and honest receivers can easily notice that Rec-i 
is dishonest by checking the integrity with hash values. Therefore, we can discern dishonest behavior among the 
receivers. 

(4) Even though our protocol uses a classical channel to distribute the information of the measurement basis from 
Alice, neither Eve nor any receiver can obtain the information from Alice, because all receivers shuffle the polarization 
bases. In other words, the measurement basis of each receiver depends on the shuffling of the other receivers. This 
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is another reason why our protocol is robust against the PNS attack. Consequently, compared with other protocols, 
communication through the classical channel of our protocol reveals no information to Eve or any dishonest receivers. 

In summary, we have proposed a new protocol of quantum secret sharing with a single not-so weak coherent pulse 
for multipartite receivers. In this protocol, because each receiver shuffles the polarization bases, no one alone can 
obtain the secret key transmitted by a sender, while all receivers can recover the key cooperatively. A dishonest 
receiver can be noticed by exchanging the hash values of the recovered key between communicators. Finally, since 
all of the operations are random and independent, the security is guaranteed against the PNS and the impersonation 
attacks. 
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